Medium severity · published Jul 21, 2026
CVE-2026-8989
Open Recovery Mode
6.8
CVSS
0.2%
EPSS
No
On KEV
Description
Autel Maxi Charger Single firmware through V1.03.51 permits unrestricted access to the NXP i.MX6 recovery mode through exposed hardware recovery pins. An attacker with physical access can boot attacker-controlled code in memory and modify or extract firmware and other sensitive data.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MS
MaxiCharger Single · Autel
through V1.03.51 · source: vendor
MS
Maxicharger Single Charger Firmware · Autel
through 1.03.51; through 1.03.51 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-8989
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-8989
Third Party Advisory
https://cyberdanube.com/security-research/multiple-vulnerabilities-in-autel-maxi-charger/
More from MaxiCharger Single
9.8
CVE-2026-8986
Command Injection via Malicious OCPP Server
9.8
CVE-2026-8985
Unauthenticated Command Injection
9.8
CVE-2026-8984
Unauthenticated RCE
9.8
CVE-2026-8983
Backdoor Authentication Token
8.8
CVE-2026-8987
Authenticated Heap Overflow